Recommendations

The Center for Internet Security (CIS) provides a detailed list of recommendations regarding the usage of docker in production. Those recommendations should be applied to the docker host on which TM containers will run. The proper implementation of those recommendations should be checked with corresponding tooling (e.g. docker-bench). It’s a matter of great importance to apply the described security hardening in order to ensure a secure usage of TM.

Service meshes are state-of-the-art technology to secure all communication within and between Kubernetes clusters. They typically intercept and redirect traffic to/from the Pods using proxy containers injected into the application Pods. These proxies can then secure communication between Pods using mTLS. In such scenarios, the service mesh control plane manages the complex and error-prone certificate management for the various mTLS connections, while being transparent to the actual application workloads.

The installation and configuration of a service mesh is the responsibility of the cluster operator and is not part of the NEXEED IAS installation process. However, it is recommended to use service meshes to secure all communication between TM and NEXEED IAS modules running in the same cluster.

TM does not encrypt the database connection by default since this is highly database-specific. Depending on the database being used, the following adaptations are highly recommended: